The API is a .NET 10 solution under backend/api, split into four projects: Domain,
Application, Infrastructure and Api. Dependencies point inward, so Domain knows about
nothing else.
Data access
EF Core with Npgsql over PostgreSQL. Migrations live in
backend/api/src/SaasCore.Infrastructure/Migrations and are created with:
npm run new-migration
Never edit an applied migration. Add a new one instead, so every environment converges on the same schema by replaying the same sequence.
Public endpoints
The marketing site talks to a small public surface that needs no authentication:
GET /api/v1/products: catalogue with plans and pricesGET /api/v1/blog/posts: published posts, optionally filtered by localePOST /api/v1/public/plans/{id}/checkout: starts a checkout and returns the provider URL
Everything else requires a bearer token issued by the auth provider.
Billing
Payment providers sit behind contracts in SaasCore.Application, and the routing rule that
picks one per buyer country is configured in the admin panel. Signed webhooks from either
provider grant the same entitlements, so adding a provider does not change the access logic.